Malicious Package

leaflet-gpx contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

angular-location-update contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

mx-nested-menu contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

ngx-pica contains malicious code. The code when executed in the browser will capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

Overview Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment an...

Malicious Package

Overview Version 0.1.2 of vue-backbone contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Vulnerability

Exploit for php platform in category web applications WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter...

WebVet 0.1a - id SQL Injection

WebVet 0.1a - id SQL Injection Exploit Title: WebVet 0.1a - 'id' SQL Injection Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://webvet.exreality.net/ Software Link: https://netix.dl.sourceforge.net/project/webvet/webvet20130708.zip Version: 0.1a Category: Webapps...

WordPress Mondula Multi Step Form Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Mondula Multi Step Form is used in one of the drag-and-drop form builder plugin . A cross-site scripting...

PT-2018-12508

Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.6 Description The issue allows for XSS exploitation via specific fields in the contact form, including fw data id1, fw data id2, fw data id3, fw data id4, or the email field. This can be...

CVE-2018-14517

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

CVE-2018-14517

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

CVE-2018-14517

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

CVE-2018-14517

SeaCMS 6.61 contains two reflected XSS flaws in admin_config.php form fields. Reports (NVD, CNVD) describe remote exploitation leading to arbitrary script/HTML execution in affected installations. Root cause: improper input handling in admin_config.php; impact includes user session or data exposu...

SeaCMS Cross-Site Scripting Vulnerability (CNVD-2018-14092)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminconfig.php file in SeaCMS version 6.61. A remote attacker can exploit this vulnerabili...

PT-2018-12560

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description The issue concerns two XSS problems located in the admin config.php file, specifically through certain form fields. Recommendations For SeaCMS version 6.61, update the admin config.php file to fix the XSS issues...

CVE-2018-14517: Improper Neutralization of Input During Web Page Generation

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce 1.5.4 - CSV Injection Google Dork: N/A Date: 2018-06-24 Exploit Author: Bhushan B. Patil Software Link: https://wordpress.org/plugins/woo-order-export-lite/ Affected Version: 1.5.4 and before Category: Plugins and Extensions...

Malicious Package

Overview Version 0.0.3 of dynamo-schema contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found install...

Malicious Package

Overview Version 0.0.4 of dossier contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.4 of this module is found installed you...